PRIVACY POLICY AND USE OF COOKIES
effective from 25.05.2018

Single Step Foundation, with UIC: 117112828, and registered office at No. 12A Bratya Miladinovi Str., (hereinafter referred to as “the Foundation”) carries out its activities in accordance with the Personal Data Protection Act and Regulation (EU) 2016/679 of the European Parliament and of the Council, which entered into force on 25.05.2018, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data. This information is intended to inform you about all aspects of the processing of your personal data by the Foundation and the rights you have in relation to this processing.

Basis for collecting, processing and storing your personal data:

The Foundation collects and processes your personal data in connection with the use of the website www.singlestep.bg and the conclusion of contracts with the Foundation on the basis of Art. 6 paragraph 1, Regulation (EU) 2016/679 (GDPR), and in particular on the following grounds:

  • Your explicit consent as a user of the website;
  • performance of the Foundation’s obligations under a contract with you;
  • compliance with a legal obligation applicable to the Foundation;
  • for the purposes of the legitimate interests of the Foundation or of a third party.

2. Collection of personal data and purposes

2.1. Single Step Foundation collects personal data on:

  1. natural persons or representatives of legal entities – providers of specific services, relations with which are regulated by contract;
  2. natural persons – members and/or official representatives or contact persons of legal entities – members of the Foundation;
  3. donors, volunteers and partners of the Foundation;
  4. users of services provided by the Foundation.

for the purposes of:

  1. the conclusion of an employment contract with the employee, pursuant to Art. 62, par. 7 of the Labour Code and Ordinance No. 4 on the documents required for concluding an employment contract;
  2. the conclusion of a civil or other contract for the provision of various services, including health and social services to third parties and individuals on behalf of Single Step Foundation
  3. the creation, operation and termination of membership relationships of the Foundation;
  4. the receipt and making of donations, the receipt of volunteer labour or partnership to raise public awareness, and any voluntary cooperation for which both parties have formal or informal correspondence and confirmation;
  5. protection of the rights of the individual, mediation for the protection of the rights of the individual;
  6. provision of various services, including health, legal, social and information services.

2.2. Processing of special categories of personal data

Single Step Foundation collects data about the health, sex life or sexual orientation of service users provided by the Foundation for the purpose of providing health, legal and social services and treatment.

Special categories of personal data are processed under the direction of a professional health care professional bound by the obligation of professional secrecy.

2.3. Personal data collected and processed by the Single Step Foundation shall be kept for as short a period as possible after the basis for processing has ceased to exist. After the grounds for processing have ceased to exist, the data shall be destroyed in accordance with the procedure laid down in the Foundation’s internal rules on the processing of personal data.

2.4. The personal data processed by Single Step Foundation may be disclosed to the following categories of recipients:

– the natural persons to whom the data relate;

– persons for whom the right of access is provided for in a legal act, such as public authorities, institutions, etc.

– donors of the Foundation – only statistical data from the processing of personal data (statistics by sex, age, place of residence) are provided to these persons, provided that at least one of the following conditions is met:

– explicit consent of the data subject;

– a statutory obligation of the controller of the personal data;

– the protection of a vital interest;

– where necessary for the purposes of a criminal prosecution.

3. Purposes and principles of collecting, processing and storing your personal data on the singlestep.bg website

3.1. We collect and process the personal data you provide to us in connection with your use of the website for the following purposes:

– creating a profile (if applicable) and providing full functionality when using singlestep.bg

– submitting alerts/complaints/inquiries from you via a form on the Foundation’s website

– statistical purposes;

– information security protection;

– sending a newsletter if you wish;

– involvement in sexual health campaigns, testing for HIV and other sexually transmitted infections;

– provision of health, legal and social services;

– advertising and remarketing purposes.

3.2. We comply with the following principles when processing your personal data:

– lawfulness, fairness and transparency;

– limitation of the purposes of processing;

– relevance to the purposes of the processing and minimisation of the data collected;

– accuracy and timeliness of data;

– limitation of storage to achieve the purposes;

– integrity and confidentiality of processing and ensuring an appropriate level of security of personal data.

3.3. In processing and storing personal data, the Foundation may process and store personal data in order to protect its following legitimate interests: the performance of its obligations to the National Revenue Agency, the Ministry of the Interior and other state and municipal authorities.

3.4. Through its website www.singlestep.bg, the Foundation does not collect or process personal data that relates to the following: revealing political, religious or philosophical beliefs, or trade union membership; genetic and biometric data.

3.5. The Foundation does not carry out automated decision-making with data.

3.6. The Foundation’s website uses so-called “cookies” for the purposes of providing full website functionality, improving user experience, statistical purposes, ease of access, etc., which you agree to by using our website. you can control and/or delete cookies at any time through the settings of the browser you are using. “Cookies” do not constitute personal data and are not used to identify visitors and users of the website.

4. Duration of storage of your personal data

4.1. The Foundation shall keep the personal data that it is required to keep under applicable law for the relevant prescribed period, which may exceed the duration of your account on the website.

4.2. The Foundation retains the personal data of the legal representatives of its business partners for the duration of the performance of the contract, in order to comply with the legitimate interests and legal obligations of the Foundation, which may extend beyond the duration of the contract.

5. Transfer of your personal data for processing

5.1. The Foundation may, at its discretion, transfer some or all of your personal data to processors for the fulfilment of the processing purposes to which you have consented, subject to the requirements of Regulation (EU) 2016/679 (GDPR).

5.2. The Foundation will notify you if it intends to transfer some or all of your personal data to third countries or international organisations.

6. Withdrawal of consent

6.1. Withdrawal of consent to the processing of your personal data – in the event that you do not wish the personal data you have provided to be processed for marketing and newsletter purposes, you may withdraw your consent to processing at any time by completing a withdrawal of consent form or by making a free text request and emailing it to us.

6.2. Once we have received your request, we will send you a letter to the email address you have provided with detailed instructions for verifying you as the recipient of newsletters and the subject of the personal data for which withdrawal of consent has been requested.

6.3. The withdrawal of consent does not affect the lawfulness of the processing of personal data that the Foundation has carried out up to that point.

7. Right of access

7.1. You have the right to request and obtain confirmation from the Foundation as to whether personal data relating to you is being processed by sending a free text request by email or completing a form to this effect.

7.2. You have the right to obtain access to the data relating to you as well as to information relating to the collection, processing and storage of your personal data.

7.3. Once we have received your request, we will send you a letter to the email address you have provided with detailed instructions for verifying you as the subject of the personal data accessed.

7.4. After verification has been carried out in accordance with par. 3, the Foundation shall provide you, upon request, with a copy of the personal data processed relating to you in electronic or other appropriate form.

7.5. The provision of access to the data is free of charge, but the Foundation reserves the right to charge an administrative fee in the event of repetitive or excessive requests.

8. Right of rectification or completion

You may correct or complete inaccurate or incomplete personal data relating to you by submitting a request to the Foundation by email using the form or by a free text request sent by email to

9. Right to erasure

9.1. You have the right to ask the Foundation to erase some or all of the personal data relating to you and the Foundation has the obligation to erase it without undue delay where any of the following grounds apply:

– the personal data is no longer necessary for the purposes for which it was collected or otherwise processed;

– you withdraw your consent on which the processing is based and there is no other legal basis for the processing;

– you object to the processing of the personal data relating to you, including for direct marketing purposes, and there are no lawful grounds for the processing which override your interests;

– the personal data have been unlawfully processed;

– the personal data must be erased in order to comply with a legal obligation under EU or Member State law to which the Foundation is subject;

– the personal data have been collected in connection with the provision of information society services.

9.2. The Foundation is not obliged to erase personal data if it stores and processes it:

– to exercise the right to freedom of expression and the right to information;

– to comply with a legal obligation requiring processing under EU or Member State law applicable to the Foundation or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Foundation;

– for reasons of public interest in the field of public health;

– for archiving purposes in the public interest, scientific or historical research or statistical purposes;

– for the establishment, exercise or defence of legal claims.

9.3. In order to exercise your right to erasure, you need to send a request for erasure of your personal data processed by the Foundation by email, either by completing a form or by a free text request, after which the Foundation will send a letter to the email address you used to register, with detailed instructions on how to verify you as the user and subject of the personal data for which erasure is requested.

9.4. Once we have verified the identity of the person who made the request and the data subject in accordance with the instructions sent to you, we will delete any data we process about you in accordance with par. 3.

10. Right to restriction

10.1. You have the right to ask the Foundation to restrict the processing of data relating to you by sending us a free text request by email where:

– you challenge the accuracy of the personal data, for a period that allows the Foundation to verify the accuracy of the personal data;

– the processing is unlawful, but you do not wish the personal data to be erased, only for its use to be restricted;

– The Foundation no longer needs the personal data for the purposes of the processing, but you require it for the establishment, exercise or defence of legal claims;

– You have objected to the processing pending verification that the Foundation’s legitimate grounds override your interests.

10.2. Once we receive your request, we will send you a letter to the email address you have provided with detailed instructions for verifying you as the user and subject of the personal data for which the restriction of processing has been requested.

11. Right to portability

11.1. If you have consented to the processing of your personal data or the processing is necessary for the performance of the contract with the Foundation, or if your data is processed in an automated manner, you may:

– request the Foundation to provide you with your personal data in a readable format and transfer it to another controller;

– ask the Foundation to transfer your personal data directly to a controller you have appointed, where this is technically feasible.

11.2. You may exercise the right to portability by emailing us a completed form or a free text request, after which the Foundation will send a letter to the email address you have provided with detailed instructions for your verification as the user and subject of the personal data for which portability is requested.

11.3. Once the verification has been completed in accordance with paragraph 2, the Foundation will send the data it processes about you to the email you have provided.

12. Right to receive information

You may request that the Foundation inform you of any recipients to whom the personal data for which rectification, erasure or restriction of processing has been requested has been disclosed. The Foundation may refuse to provide this information if it would be impossible or would require a disproportionate effort.

13. Right to object

You may object at any time to the Foundation processing personal data relating to you, including if it is processed for profiling or direct marketing purposes.

14. Your rights in the event of a personal data breach

14.1. If the Foundation becomes aware of a breach of the security of your personal data that may pose a high risk to your rights and freedoms, it shall notify you without undue delay of the breach and of the measures that have been taken or are to be taken.

14.2. The Foundation is not required to notify you if:

– it has taken appropriate technical and organisational measures to protect the data affected by the security breach;

– has subsequently taken measures to ensure that the breach will not result in a high risk to your rights;

– notification would require a disproportionate effort.

15. Persons to whom your personal data are disclosed

15.1. For the purposes of processing your personal data, responding to complaints/alerts/requests and services received, including through our website www.singlestep.bg, and in view of your interests, the Foundation may provide the data to the following data processors: state and municipal authorities, justice authorities, bodies responsible for the protection of the rights of the individual.

15.2. Processors shall comply with all legality and security requirements in the processing and storage of your personal data.

15.3. The Foundation does not transfer your data to third countries.

15.4. In the event of a breach of your rights under the above or applicable data protection legislation, you have the right to lodge a complaint with the Data Protection Commission as follows:

Personal Data Protection Commission
Headquarters and registered office:
Sofia 1592, 2 Prof. Tsvetan Lazarov Boulevard
Address for correspondence
The address of the registered office and the address of the address of the registered office are:
Sofia 1592, 2 Prof. Tsvetan Lazarov Boulevard
Phone: 02 915 3 518
Website: http://www.cpdp.bg

15.5. You may exercise all your rights regarding the protection of your personal data in any form that contains a statement to that effect and identifies you as the data holder or use a form for that purpose.